CVE-2026-115642: 
Linux Debian Analyse et atténuation de la vulnérabilité

CVE-2026-115642 is an authorization bypass vulnerability in OpenStack keystonemiddleware and Keystone, allowing authenticated attackers to circumvent application credential access_rules enforcement by injecting an arbitrary X-Service-Token HTTP header. The flaw was reported by Nassim Abbaoui of OVHcloud and disclosed on October 29, 2026. Affected upstream versions include keystonemiddleware < 10.12.2, >= 11.0.0 < 12.0.1, and >= 13.0.0 < 13.0.2. It carries a CVSS v3.1 base score of 6.3 (Medium/High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is Incorrect Authorization (CWE-863) in BaseAuthProtocol.validate_allowed_request() within keystonemiddleware/auth_token/__init__.py (lines 592–596). The code incorrectly checks for the raw presence of the X-Service-Token HTTP header (request.service_token) rather than verifying that the token has been validated (request.service_token_valid), causing access_rules enforcement to be skipped entirely when any non-empty header value is present. A secondary flaw at lines 420–421 similarly skips _confirm_token_bind() under the same erroneous header-presence check. This bypass is most impactful when delay_auth_decision is enabled, which is the typical deployment configuration (Red Hat Bugzilla, Red Hat CVE).

An attacker who holds an application credential configured with restrictive access_rules can bypass those restrictions and make API calls beyond what the credential was designed to permit, within the bounds of their existing roles. This results in low-level confidentiality, integrity, and availability impacts — the attacker can read, modify, or affect resources they should not have access to under the credential's intended scope. The vulnerability does not grant access beyond the attacker's assigned roles, but it effectively nullifies fine-grained access control enforced via application credential rules (Red Hat CVE, Red Hat Bugzilla).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The CVE status remains "Reserved" and the vulnerability was verified via static analysis (PSIRTSUPT-26333). No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires low privileges (a valid application credential) and no user interaction, making it relatively straightforward for an insider or compromised credential holder to abuse once the technique is known.

1. Obtain an application credential: Acquire or compromise an OpenStack application credential that has restrictive access_rules limiting which API methods and paths can be called.
2. Identify target deployment: Confirm the target OpenStack environment runs a vulnerable version of keystonemiddleware (< 10.12.2, >= 11.0.0 < 12.0.1, or >= 13.0.0 < 13.0.2) with delay_auth_decision enabled.
3. Craft the bypass request: Construct an API request using the restricted application credential, and add an X-Service-Token HTTP header with any non-empty arbitrary value (a valid service token is not required).
4. Send the request: Submit the crafted request to the target OpenStack API endpoint that would normally be blocked by the credential's access_rules.
5. Achieve unauthorized access: The middleware skips access_rules enforcement due to the header presence check, allowing the API call to proceed and granting access to resources or operations beyond the credential's intended scope (Red Hat Bugzilla, Red Hat CVE).

• Network: API requests to OpenStack service endpoints that include an X-Service-Token header originating from clients that are not recognized OpenStack services or inter-service communication paths.
• Logs: keystonemiddleware auth_token logs showing requests authenticated with application credentials accessing API paths or methods not permitted by the credential's access_rules; absence of token-bind validation log entries where expected.
• Logs: Requests where X-Service-Token is present but does not correspond to a valid, validated service token in Keystone audit logs.
• Behavioral: Application credentials with defined access_rules successfully invoking API calls on restricted endpoints without corresponding service-to-service communication context (Red Hat Bugzilla).

The primary remediation is to install fixed versions of keystonemiddleware and Keystone packages: upstream fixed versions are 10.12.2, 12.0.1, and 13.0.2, with patches proposed for stable branches 2026.2, 2026.1, 2025.2, and 2025.1 (master branch 2027.1). As interim workarounds, administrators should implement network-level controls to strip or block the X-Service-Token header from untrusted external sources, and audit all application credentials with access_rules for potential misuse. Monitoring keystonemiddleware logs for anomalous X-Service-Token usage patterns is also recommended until patched packages are deployed (Red Hat Bugzilla, Red Hat CVE).

The vulnerability was disclosed via the oss-security mailing list and noted on social media (Bluesky/infosec community) shortly after publication on October 29, 2026. Tenable published a Nessus plugin (ID 373874) to detect the vulnerability. No major vendor statements beyond Red Hat's CVE advisory have been identified at this time (Red Hat CVE).